|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #47768 httpd ( Apache 2.2 ) crashes of abort() in signal handler
Submitted: 2009-03-24 22:58 UTC Modified: 2018-01-13 11:34 UTC
From: hossy421 at yahoo dot co dot jp Assigned: nikic (profile)
Status: Closed Package: Apache2 related
PHP Version: 5.2.9 OS: FreeBSD 6.3-RELEASE-p9
Private report: No CVE-ID: None
View Add Comment Developer Edit
Anyone can comment on a bug. Have a simpler test case? Does it work for you on a different platform? Let us know!
Just going to say 'Me too!'? Don't clutter the database with that please !
Your email address:
Solve the problem:
48 - 3 = ?
Subscribe to this entry?

 [2009-03-24 22:58 UTC] hossy421 at yahoo dot co dot jp
httpd ( Apache 2.2 ) crashes below messages.

> httpd in free(): error: recursive call
> [notice] child pid XXXXX exit signal Abort trap (6)

XXXXX is process id of a httpd child process.

Reproduce code:
sorry, I could't repro this bug in another environment.

Actual result:
this is backtrace.

Program received signal SIGABRT, Aborted.
0x2836b56f in kill () from /lib/
(gdb) bt
#0  0x2836b56f in kill () from /lib/
#1  0x2828d27b in raise () from /usr/lib/
#2  0x2836a2ab in abort () from /lib/
#6  0x2830662c in free () from /lib/
#7  0x28617828 in php_error_cb (type=1,
    error_filename=0x86b1e38 "/usr/home/hossy/public_html/test.php", error_lineno=391,
    format=0x2874febc "Maximum execution time of %d second%s exceeded", args=0xbfbf7898 "\n")
    at /usr/ports/lang/php5/work/php-5.2.9/main/main.c:824
#10 0x282920d3 in sigaction () from /usr/lib/
#11 <signal handler called>
#15 0x2830662c in free () from /lib/
#16 0x28644cb5 in zend_mm_mem_malloc_free (storage=0x80a1690, ptr=0xa81c000)
    at /usr/ports/lang/php5/work/php-5.2.9/Zend/zend_alloc.c:276

1. httpd cought SIGPROF in free() because of `max_execution_time' parameter.
2. php_error_cb() called free()
3. free() detected as `recursive call.'

in zend_mm_mem_malloc_free(), signal is blocked from HANDLE_BLOCK_INTERRUPTIONS macro.
but, apache2handler does't have the function for it.

(gdb) p zend_block_interruptions
$1 = (void (*)(void)) 0
(gdb) p sapi_module
$2 = {name = 0x28759d5d "apache2handler", pretty_name = 0x28759d6c "Apache 2.0 Handler",
  block_interruptions = 0, unblock_interruptions = 0,
(gdb) p apache2_sapi_module
$3 = {name = 0x28759d5d "apache2handler", pretty_name = 0x28759d6c "Apache 2.0 Handler",
  block_interruptions = 0, unblock_interruptions = 0,

in japanese mailing list, I got a patch for this problem.


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2009-03-31 07:49 UTC]
Not enough information was provided for us to be able
to handle this bug. Please re-read the instructions at

If you can provide more information, feel free to add it
to this bug and change the status back to "Open".

Thank you for your interest in PHP.

 [2009-04-08 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 [2012-06-11 14:14 UTC]
-Status: No Feedback +Status: Open
 [2012-06-11 14:14 UTC]
I believe this isn't fixed yet...
 [2018-01-13 11:34 UTC]
-Status: Open +Status: Closed -Assigned To: +Assigned To: nikic
 [2018-01-13 11:34 UTC]
This has been fixed in PHP 7.1. PHP will no longer interrupt internal function calls on timeout.
PHP Copyright © 2001-2023 The PHP Group
All rights reserved.
Last updated: Thu Sep 28 04:01:24 2023 UTC